Read the docs

TAPHOME

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

TAPHOME records in CISA KEV

No TAPHOME vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Core Firmware 2 records MEDIUM

Records

2 records in Core Firmware · all components

TI-2023-02583 CVE-2023-2759 · GHSA-vmw7-j325-rffg

TAPHOME Improper Authentication in Core Platform

Priority MEDIUM 41

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00555 Published 2023-07-17 Fixed in 2023.2 CWE-863
TI-2023-02584 CVE-2023-2760 · GHSA-3639-77vf-hx6g

TAPHOME SQL Injection in Core Platform

Priority LOW 34

An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and exec…

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00434 Published 2023-07-17 Fixed in 2023.2 CWE-89
Open these records in search →